W32/Forbot-EK is a worm which attempts to spread to remote network shares. The worm also contains backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Forbot-EK copies itself to the Windows system folder as doit.exe and attempts to create a service with a Service Name and Display Name of "doit.exe" set to run the worm when Windows starts up.
W32/Forbot-EK sets the following registry entries so that the worm is run when a user logs on to Windows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
doit.exe
"doit.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\
doit.exe
"doit.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
doit.exe
"doit.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\
doit.exe
"doit.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
doit.exe
"doit.exe"
W32/Forbot-EK attempts to spread to network shares in response to commands received from a remote attacker using the backdoor component of the worm.
W32/Forbot-EK may attempt to delete network shares on the infected computer.
W32/Forbot-EK will attempt to terminate processes on the infected computer that are associated with computer security products such as AV scanners and firewalls.